<head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<title>kali工具箱</title>
<script src="./static/bootstrap.min.js"></script>
<link rel="stylesheet" href="./static/main.css">
<link rel="stylesheet" href="./static/bootstrap.min.css">
<style type="text/css" id="syntaxhighlighteranchor"></style>
</head>
<main class="main-container ng-scope" ng-view="">
<div class="main receptacle post-view ng-scope">
<article class="entry ng-scope" ng-controller="EntryCtrl" ui-lightbox="">
<section class="entry-content ng-binding" ng-bind-html="postContentTrustedHtml">
<section class="l-section"><div class="l-section-h i-cf"><h2>extundelete Package Description</h2>
<p style="text-align: justify;">extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition’s journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files.</p>
<p>Source: http://extundelete.sourceforge.net/<br>
<a href="http://extundelete.sourceforge.net/" variation="deepblue" target="blank">extundelete Homepage</a> | <a href="http://git.kali.org/gitweb/?p=packages/extundelete.git;a=summary" variation="deepblue" target="blank">Kali extundelete Repo</a></p>
<ul>
<li>Author: Nic Case</li>
<li>License: GPLv2</li>
</ul>
<h3>Tools included in the extundelete package</h3>
<h5>extundelete – Utility to recover deleted files from ext3/ext4 partition</h5>
<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="790b16160d3912181510">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# extundelete --help<br>
Usage: extundelete [options] [--] device-file<br>
Options:<br>
  --version, -[vV]       Print version and exit successfully.<br>
  --help,                Print this help and exit successfully.<br>
  --superblock           Print contents of superblock in addition to the rest.<br>
                         If no action is specified then this option is implied.<br>
  --journal              Show content of journal.<br>
  --after dtime          Only process entries deleted on or after 'dtime'.<br>
  --before dtime         Only process entries deleted before 'dtime'.<br>
Actions:<br>
  --inode ino            Show info on inode 'ino'.<br>
  --block blk            Show info on block 'blk'.<br>
  --restore-inode ino[,ino,...]<br>
                         Restore the file(s) with known inode number 'ino'.<br>
                         The restored files are created in ./RESTORED_FILES<br>
                         with their inode number as extension (ie, file.12345).<br>
  --restore-file 'path'  Will restore file 'path'. 'path' is relative to root<br>
                         of the partition and does not start with a '/' (it<br>
                         must be one of the paths returned by --dump-names).<br>
                         The restored file is created in the current<br>
                         directory as 'RECOVERED_FILES/path'.<br>
  --restore-files 'path' Will restore files which are listed in the file 'path'.<br>
                         Each filename should be in the same format as an option<br>
                         to --restore-file, and there should be one per line.<br>
  --output-dir 'path'    Restore files in the output dir 'path'.<br>
                         By default the restored files are created under current directory 'RECOVERED_FILES'.<br>
  --restore-all          Attempts to restore everything.<br>
  -j journal             Reads an external journal from the named file.<br>
  -b blocknumber         Uses the backup superblock at blocknumber when opening<br>
                         the file system.<br>
  -B blocksize           Uses blocksize as the block size when opening the file<br>
                         system.  The number should be the number of bytes.</code>
<h3>extundelete Usage Example</h3>
<p>Read the partition <b><i>(/dev/sda1)</i></b> and restore <b><i>(–restore-file)</i></b> the given file name <b><i>(root/importantfile)</i></b>:</p>
<code><a class="__cf_email__" href="/cdn-cgi/l/email-protection" data-cfemail="6f1d00001b2f040e0306">[email&#160;protected]</a><script data-cfhash='f9e31' type="text/javascript">/* <![CDATA[ */!function(t,e,r,n,c,a,p){try{t=document.currentScript||function(){for(t=document.getElementsByTagName('script'),e=t.length;e--;)if(t[e].getAttribute('data-cfhash'))return t[e]}();if(t&&(c=t.previousSibling)){p=t.parentNode;if(a=c.getAttribute('data-cfemail')){for(e='',r='0x'+a.substr(0,2)|0,n=2;a.length-n;n+=2)e+='%'+('0'+('0x'+a.substr(n,2)^r).toString(16)).slice(-2);p.replaceChild(document.createTextNode(decodeURIComponent(e)),c)}p.removeChild(t)}}catch(u){}}()/* ]]> */</script>:~# extundelete /dev/sda1 --restore-file root/importantfile<br>
WARNING: Extended attributes are not restored.<br>
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.<br>
The partition should be unmounted to undelete any files without further data loss.<br>
If the partition is not currently mounted, this message indicates <br>
it was improperly unmounted, and you should run fsck before continuing.<br>
If you decide to continue, extundelete may overwrite some of the deleted<br>
files and make recovering those files impossible.  You should unmount the<br>
file system and check it with fsck before using extundelete.<br>
Would you like to continue? (y/n) <br>
y<br>
Loading filesystem metadata ... 192 groups loaded.<br>
Loading journal descriptors ... 29495 descriptors loaded.<br>
Writing output to directory RECOVERED_FILES/</code>
</div></section><div style="display:none">
<script src="//s11.cnzz.com/z_stat.php?id=1260038378&web_id=1260038378" language="JavaScript"></script>
</div>
</main></body></html>
